sitemap-index.xml served with Content-Disposition: attachment, breaking Google Search Console

[alexandreIFB]

The sitemap-index.xml endpoint returns a Content-Disposition: attachment header, which causes search engine crawlers to fail when fetching the sitemap index.

This header forces the response to be treated as a file download instead of inline content, which is not the expected behavior for an XML sitemap.

Steps to reproduce

curl -I https://<your-site>/sitemap-index.xml

Response includes:

Content-Type: application/xml
Content-Disposition: attachment; filename="sitemap-index.xml"

Expected behavior

sitemap-index.xml should be served as inline content, with no Content-Disposition header (or inline at most). The Content-Type: application/xml alone is sufficient.

Actual behavior

Google Search Console reports an error when submitting the sitemap index URL. The attachment disposition causes crawlers to treat the response as a binary download rather than parseable XML.

Root cause

The sitemapIndex handler has a Content-Disposition: attachment header that appears to have been copied from sitemapIndexCompatibility, where it is appropriate since that handler serves a gzip binary file (.gz). For the plain XML response it serves no purpose and breaks crawler compatibility.

volto/packages/volto/src/express-middleware/sitemap.js

Lines 42 to 56 in 3cc7be4

	export const sitemapIndex = function (req, res, next) {
	generateSitemapIndex(req).then((sitemapIndex) => {
	res.set('Content-Type', 'application/xml');
	res.set('Content-Disposition', 'attachment; filename="sitemap-index.xml"');
	res.send(sitemapIndex);
	});
	};
	export const sitemapIndexCompatibility = function (req, res, next) {
	generateSitemapIndex(req, true).then((sitemapIndex) => {
	res.set('Content-Type', 'application/x-gzip');
	res.set('Content-Disposition', 'attachment; filename="sitemap.xml.gz"');
	res.send(sitemapIndex);
	});
	};